It should be random: A random sample is one in which each item in the sample has an equal chance of being selected. Statistical inferences may not be valid unless the sample is random.
It should be representative: the sample should be representative of the differing items in the whole population. For example it should contain a similar proportion of high and low value items of the population.
Protective: Protective of the auditor. More intensive auditing should occur on high value items known to be high risk.
Unpredictable - client should not be able to know which items will be examined.